CVE-2026-26011
Heap Out-of-Bounds Write in Nav2 AMCL Causes DoS
Publication date: 2026-02-12
Last updated on: 2026-02-23
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| opennav | nav2 | to 1.3.11 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-122 | A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). |
| CWE-787 | The product writes data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-26011 is a critical heap out-of-bounds write vulnerability in the ROS 2 navigation2 package, specifically in the AMCL (Adaptive Monte Carlo Localization) particle filter clustering logic. It occurs when an unauthenticated attacker on the same ROS 2 DDS domain publishes a specially crafted geometry_msgs/PoseWithCovarianceStamped message with extreme covariance values to the /initialpose topic.
The extreme covariance values cause a negative index write (set->clusters[-1]) into heap memory just before the allocated buffer. This happens because the kd-tree key calculation produces inconsistent keys due to integer overflow and the negative index returned by a lookup function is unchecked in release builds, leading to an out-of-bounds write.
This vulnerability allows controlled corruption of heap metadata, which can be exploited for further attacks such as remote code execution. At minimum, it causes a reliable denial of service by crashing the AMCL node and halting robot localization and navigation.
How can this vulnerability impact me? :
The vulnerability can have severe impacts including:
- Denial of Service (DoS): A single crafted message can crash the AMCL node, stopping localization and navigation, effectively disabling the robot.
- Potential Remote Code Execution (RCE): The heap out-of-bounds write allows an attacker to corrupt heap metadata in a controlled way, which can be exploited to overwrite function pointers or vtables, enabling arbitrary code execution with the privileges of the Nav2 process.
- This can lead to full compromise of robotic systems running the vulnerable navigation2 version, especially since the Nav2 process often runs with elevated privileges.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for abnormal or malicious messages published to the /initialpose topic in the ROS 2 DDS domain, specifically geometry_msgs/PoseWithCovarianceStamped messages containing extreme covariance values.
Detection can involve checking for unusually large covariance values in messages or observing crashes or denial of service symptoms in the AMCL node.
A practical approach is to subscribe to the /initialpose topic and inspect the covariance field of incoming messages for extreme or out-of-range values.
- Use ROS 2 command line tools to echo messages on the /initialpose topic: `ros2 topic echo /initialpose`
- Filter or script to analyze covariance values in the PoseWithCovarianceStamped messages for extreme values (e.g., values near or exceeding 1.58e16).
- Monitor the AMCL node logs and system logs for crashes or abnormal termination indicating a denial of service triggered by this vulnerability.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the ROS 2 DDS domain to prevent unauthenticated attackers from publishing malicious messages to the /initialpose topic.
Implement message validation to reject PoseWithCovarianceStamped messages with extreme covariance values before they reach the AMCL node.
Apply the patch or update that adds validation for the covariance field in the pose message, as introduced in the recent code commit enhancing message validation.
- Use ROS 2 security features such as SROS2 to enforce authentication and authorization on topics.
- Deploy network segmentation or firewall rules to limit access to the ROS 2 DDS domain.
- Monitor and audit published messages to detect and block suspicious payloads.
Since no patched version is available yet, these mitigations are critical to reduce risk until an official fix is released.